3.5.5 — Don't Recycle Usernames

The One-Liner

Recycling a username too quickly creates audit log confusion and can accidentally give the new person access to the old person’s resources.

What It Says

Prevent reuse of identifiers for a defined period.

What It Actually Means

When someone leaves, their username shouldn’t be given to a new hire immediately. Two reasons:

1. Audit trail confusion. Log entries for “jsmith” now refer to two different people depending on the date. An investigation becomes ambiguous.
2. Inherited access. If the old jsmith’s permissions weren’t fully revoked, the new jsmith might inherit access they shouldn’t have.

Define the retention period in your access control policy — 90 days is the common standard. The assessor will ask what your policy states and verify it’s enforced.

This also applies to service accounts. Don’t repurpose an old service account for a new function — create a new one with a new identifier.

---

Pass or Fail

Your assessor needs a “yes” to every row:

#	Question	What “yes” looks like
1	Is a defined period for identifier reuse established?	Policy states identifiers aren’t reused for 90 days (or your defined period)
2	Is identifier reuse prevented for that period?	The system enforces the retention — disabled accounts kept in AD for the defined period

---

What to Have Ready on Assessment Day

Documents they’ll review: Identification and authentication policy; procedures addressing identifier management; system security plan; system configuration settings

People they’ll talk to: Personnel with account management responsibilities; personnel with information security responsibilities; system or network administrators

Live demos they’ll ask for: Mechanisms supporting or implementing identifier management

---

The Assessor’s Playbook

These are the actual questions. Have answers ready.

• “What is your defined period for identifier reuse?”
• “Show me it’s documented in your policy.”
• “Can you show me that disabled accounts are retained for the defined period?”
• “Has any username been reused within the retention period? How would you know?”

Real-World Example

A contractor’s access control policy states: ‘User identifiers shall not be reused for a minimum of 90 days following account disablement.’ When an employee leaves, the Entra ID account is disabled (not deleted) and moved to a ‘Disabled Accounts’ OU. A monthly script checks for accounts in the OU older than 90 days and archives them. The assessor asks for a recent departure — IT shows the disabled account still in Entra, created date, disabled date, and confirms no new account has been created with the same UPN.

---

Where Companies Trip Up

Immediate reuse. New hire on Monday gets the username of someone who left Friday. 90-day retention prevents this.

Accounts deleted instead of disabled. If you delete the account, you lose the audit trail. Disable and retain for the defined period.

No defined period in policy. You don’t reuse usernames in practice but there’s no documented policy. The assessor needs a written number.

Service account reuse. Old service account repurposed for new function without changing the identifier. Create a new one.

---

How to Talk About This

To a CEO or Board

We don’t recycle usernames for at least 90 days after departure. Old accounts are disabled and retained to preserve the audit trail.

To an Engineering Team

90-day identifier retention policy. Disabled accounts kept in Entra ‘Disabled’ OU. Monthly cleanup script archives accounts past 90 days. No UPN reuse. Service accounts: new function = new identifier. Documented in access control policy.

---

Connected Requirements

Requirement	Why it matters here
3.5.1 — Prove Who You Are	Establishes unique identifiers this control protects from premature reuse
3.3.2 — Trace Every Action	Identifier reuse undermines the ability to trace actions to individuals
3.9.2 — Revoke on Departure	The offboarding process that disables (not deletes) identifiers

---

Implementation

🔒

Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.

Start a conversation →

---

CMMC Practice ID: IA.L2-3.5.5 | SPRS Weight: 1 point | POA&M Eligible: Yes